What’s Vulnerable › Vulnerabilities

CVE-2023-2179: WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-15 · updated 2026-06-17

Description

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example

Affected products

• WooCommerce Order Status Change Notifier: through 1.1.0

References

• https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551
• https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551

Get alerted when CVE-2023-2179 or the next vulnerability affects your stack